-
Notifications
You must be signed in to change notification settings - Fork 5
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
6885a54
commit 36235b0
Showing
9 changed files
with
221 additions
and
7 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
39 changes: 39 additions & 0 deletions
39
src/main/java/com/uid2/admin/job/EncryptionJob/SaltEncryptionJob.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| package com.uid2.admin.job.EncryptionJob; | ||
|
|
||
| import com.uid2.admin.job.model.Job; | ||
| import com.uid2.admin.model.PrivateSiteDataMap; | ||
| import com.uid2.admin.store.MultiScopeStoreWriter; | ||
| import com.uid2.admin.util.PrivateSiteUtil; | ||
| import com.uid2.admin.util.PublicSiteUtil; | ||
| import com.uid2.shared.auth.OperatorKey; | ||
| import com.uid2.shared.model.SaltEntry; | ||
|
|
||
| import java.util.Collection; | ||
|
|
||
| public class SaltEncryptionJob extends Job { | ||
| private final Collection<OperatorKey> globalOperators; | ||
| private final Collection<SaltEntry> saltEntries; | ||
| private final MultiScopeStoreWriter<Collection<SaltEntry>> multiScopeStoreWriter; | ||
|
|
||
| public SaltEncryptionJob(Collection<OperatorKey> globalOperators, | ||
| Collection<SaltEntry> saltEntries, | ||
| MultiScopeStoreWriter<Collection<SaltEntry>> multiScopeStoreWriter) { | ||
| this.globalOperators = globalOperators; | ||
| this.saltEntries = saltEntries; | ||
| this.multiScopeStoreWriter = multiScopeStoreWriter; | ||
| } | ||
|
|
||
|
|
||
| @Override | ||
| public String getId() { | ||
| return "cloud-encryption-sync-salts"; | ||
| } | ||
|
|
||
| @Override | ||
| public void execute() throws Exception { | ||
| PrivateSiteDataMap<SaltEntry> desiredPrivateState = PrivateSiteUtil.getPrivateSaltEntries(saltEntries, globalOperators); | ||
| multiScopeStoreWriter.uploadPrivateWithEncryption(desiredPrivateState, null); | ||
| PrivateSiteDataMap<SaltEntry> desiredPublicState = PublicSiteUtil.getPublicSaltEntries(saltEntries, globalOperators); | ||
| multiScopeStoreWriter.uploadPublicWithEncryption(desiredPublicState, null); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
66 changes: 66 additions & 0 deletions
66
src/main/java/com/uid2/admin/store/factory/SaltStoreFactory.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,66 @@ | ||
| package com.uid2.admin.store.factory; | ||
|
|
||
| import com.uid2.admin.store.FileManager; | ||
| import com.uid2.admin.store.version.VersionGenerator; | ||
| import com.uid2.admin.store.writer.EncyptedSaltStoreWriter; | ||
| import com.uid2.admin.store.writer.StoreWriter; | ||
| import com.uid2.shared.cloud.TaggableCloudStorage; | ||
| import com.uid2.shared.store.CloudPath; | ||
| import com.uid2.shared.store.RotatingEncryptedSaltProvider; | ||
| import com.uid2.shared.store.RotatingSaltProvider; | ||
| import com.uid2.shared.store.reader.RotatingCloudEncryptionKeyProvider; | ||
| import com.uid2.shared.store.reader.StoreReader; | ||
| import com.uid2.shared.store.scope.EncryptedScope; | ||
| import io.vertx.core.json.JsonObject; | ||
|
|
||
| import java.util.Collection; | ||
|
|
||
| public class SaltStoreFactory implements EncryptedStoreFactory<Collection<RotatingSaltProvider.SaltSnapshot>> { | ||
| JsonObject config; | ||
| CloudPath rootMetadatapath; | ||
| RotatingSaltProvider saltProvider; | ||
| FileManager fileManager; | ||
| TaggableCloudStorage taggableCloudStorage; | ||
| VersionGenerator versionGenerator; | ||
| RotatingCloudEncryptionKeyProvider cloudEncryptionKeyProvider; | ||
|
|
||
| public SaltStoreFactory(JsonObject config, CloudPath rootMetadataPath, RotatingSaltProvider saltProvider, FileManager fileManager, | ||
| TaggableCloudStorage taggableCloudStorage, VersionGenerator versionGenerator, | ||
| RotatingCloudEncryptionKeyProvider cloudEncryptionKeyProvider) { | ||
| this.config = config; | ||
| this.rootMetadatapath = rootMetadataPath; | ||
| this.saltProvider = saltProvider; | ||
| this.fileManager = fileManager; | ||
| this.taggableCloudStorage = taggableCloudStorage; | ||
| this.versionGenerator = versionGenerator; | ||
| this.cloudEncryptionKeyProvider = cloudEncryptionKeyProvider; | ||
| } | ||
|
|
||
| @Override | ||
| public StoreWriter<Collection<RotatingSaltProvider.SaltSnapshot>> getEncryptedWriter(Integer siteId, boolean isPublic) { | ||
| return new EncyptedSaltStoreWriter(config, saltProvider, fileManager, taggableCloudStorage, versionGenerator, | ||
| new EncryptedScope(rootMetadatapath, siteId, isPublic), cloudEncryptionKeyProvider, siteId); | ||
| } | ||
|
|
||
| @Override | ||
| public StoreReader<Collection<RotatingSaltProvider.SaltSnapshot>> getEncryptedReader(Integer siteId, boolean isPublic) { | ||
| return new RotatingEncryptedSaltProvider(taggableCloudStorage, | ||
| new EncryptedScope(rootMetadatapath, siteId, isPublic).getMetadataPath().toString(), | ||
| cloudEncryptionKeyProvider); | ||
| } | ||
|
|
||
| @Override | ||
| public RotatingCloudEncryptionKeyProvider getCloudEncryptionProvider() { | ||
| return cloudEncryptionKeyProvider; | ||
| } | ||
|
|
||
| @Override | ||
| public StoreReader<Collection<RotatingSaltProvider.SaltSnapshot>> getReader(Integer siteId) { | ||
| return null; | ||
| } | ||
|
|
||
| @Override | ||
| public StoreWriter<Collection<RotatingSaltProvider.SaltSnapshot>> getWriter(Integer siteId) { | ||
| return null; | ||
| } | ||
| } |
75 changes: 75 additions & 0 deletions
75
src/main/java/com/uid2/admin/store/writer/EncyptedSaltStoreWriter.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,75 @@ | ||
| package com.uid2.admin.store.writer; | ||
|
|
||
| import com.uid2.admin.store.FileManager; | ||
| import com.uid2.admin.store.version.VersionGenerator; | ||
| import com.uid2.shared.cloud.TaggableCloudStorage; | ||
| import com.uid2.shared.encryption.AesGcm; | ||
| import com.uid2.shared.model.CloudEncryptionKey; | ||
| import com.uid2.shared.store.CloudPath; | ||
| import com.uid2.shared.store.RotatingSaltProvider; | ||
| import com.uid2.shared.store.reader.RotatingCloudEncryptionKeyProvider; | ||
| import com.uid2.shared.store.scope.StoreScope; | ||
| import org.slf4j.Logger; | ||
| import org.slf4j.LoggerFactory; | ||
| import io.vertx.core.json.JsonObject; | ||
|
|
||
| import java.nio.charset.StandardCharsets; | ||
| import java.util.Base64; | ||
|
|
||
| public class EncyptedSaltStoreWriter extends SaltStoreWriter implements StoreWriter { | ||
| private StoreScope scope; | ||
| private RotatingCloudEncryptionKeyProvider cloudEncryptionKeyProvider; | ||
| private Integer siteId; | ||
|
|
||
| private static final Logger LOGGER = LoggerFactory.getLogger(EncyptedSaltStoreWriter.class); | ||
| public EncyptedSaltStoreWriter(JsonObject config, RotatingSaltProvider provider, FileManager fileManager, | ||
| TaggableCloudStorage cloudStorage, VersionGenerator versionGenerator, StoreScope scope, | ||
| RotatingCloudEncryptionKeyProvider cloudEncryptionKeyProvider, Integer siteId) { | ||
| super(config, provider, fileManager, cloudStorage, versionGenerator); | ||
| this.scope = scope; | ||
| this.cloudEncryptionKeyProvider = cloudEncryptionKeyProvider; | ||
| this.siteId = siteId; | ||
| } | ||
|
|
||
| @Override | ||
| protected java.lang.String getSaltSnapshotLocation(RotatingSaltProvider.SaltSnapshot snapshot) { | ||
| return scope.resolve(new CloudPath(saltSnapshotLocationPrefix + snapshot.getEffective().toEpochMilli())).toString(); | ||
| } | ||
|
|
||
| @Override | ||
| protected void upload(String data, String location) throws Exception { | ||
| if (siteId == null) { | ||
| throw new IllegalStateException("Site ID is not set."); | ||
| } | ||
|
|
||
| CloudEncryptionKey encryptionKey = null; | ||
| try { | ||
| encryptionKey = cloudEncryptionKeyProvider.getEncryptionKeyForSite(siteId); | ||
| } catch (IllegalStateException e) { | ||
| LOGGER.error("Error: No Cloud Encryption keys available for encryption for site ID: {}", siteId, e); | ||
| } | ||
| JsonObject encryptedJson = new JsonObject(); | ||
| if (encryptionKey != null) { | ||
| byte[] secret = Base64.getDecoder().decode(encryptionKey.getSecret()); | ||
| byte[] encryptedPayload = AesGcm.encrypt(data.getBytes(StandardCharsets.UTF_8), secret); | ||
| encryptedJson.put("key_id", encryptionKey.getId()) | ||
| .put("encryption_version", "1.0") | ||
| .put("encrypted_payload", Base64.getEncoder().encodeToString(encryptedPayload)); | ||
| } else { | ||
| throw new IllegalStateException("No Cloud Encryption keys available for encryption for site ID: " + siteId); | ||
| } | ||
|
|
||
|
|
||
| super.upload(encryptedJson.encodePrettily(), location); | ||
| } | ||
|
|
||
| @Override | ||
| public void upload(Object data, JsonObject extraMeta) throws Exception { | ||
| super.upload((RotatingSaltProvider.SaltSnapshot) data); | ||
| } | ||
|
|
||
| @Override | ||
| public void rewriteMeta() throws Exception { | ||
|
|
||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters